Explain Barnardisation
Barnardisation is a technique used in statistical disclosure control (SDC) to protect individual privacy when publishing tables of aggregate count data (such as census results or health statistics).
By injecting a small amount of random "noise" into table cells, it prevents unauthorized users from identifying specific individuals, while still preserving the overall statistical utility of the data.
How It Works
When data is presented in a table (e.g., number of residents in a small neighborhood categorized by age and health status), very small numbers (like 1 or 2) can inadvertently reveal personal identities.
Barnardisation protects privacy by applying a pseudo-random perturbation to non-zero cell counts:
-
Cell Adjustment: For each internal cell in a count table, an integer adjustment of $+1$, $0$, or $-1$ is randomly selected.
-
Probabilities: The probabilities associated with the adjustment are defined as:
-
$+1$ with probability $p/2$
-
$0$ (no change) with probability $1 - p$
-
$-1$ with probability $p/2$
-
-
Recalculating Totals: Table row and column totals are then calculated by summing the newly adjusted cell counts.
Because the expected value of the noise added is zero ($E[\text{adjustment}] = 0$), the technique is unbiased on average across large tables.
Origin of the Term
The technique is named after Professor George Alfred Barnard (1915–2002), a prominent British statistician and former President of the Royal Statistical Society.
In the lead-up to the 1971 UK Census, Barnard recommended introducing small random error adjustments to replace simple rounding, creating a better balance between confidentiality and data accuracy. The term began appearing in official UK statistical literature in the late 1970s and 1980s and remains in use by UK statistical bodies today.
Pros and Cons
| Advantages | Disadvantages / Vulnerabilities |
| Unbiased: Does not systematically skew overall averages or totals. | Differencing Attacks: If multiple overlapping tables are published, sophisticated users may subtract tables to reconstruct original counts. |
| High Utility: Has less impact on user analysis compared to coarse rounding methods (e.g., rounding to base 5). | Unadjusted Low Counts: Depending on the value chosen for $p$, some small counts (like 1s) may remain unadjusted. |
| Simple Implementation: Computationally simple to apply across large census datasets. | Modern Alternatives Preferred: Newer approaches like differential privacy offer stronger mathematical privacy guarantees. |
